Financial Data Leaked From Consulting, Payroll & HR Companies
Banks and retail organizations aren’t the only targets when it comes to stolen financial information - other third-party consultants and business service providers deal with the same type of data, and criminals know it.
In the recent massive Sony Pictures Entertainment hack now being investigated by FBI, not only was internal financial information leaked online, but also compensation information on over 30,000 Deloitte employees that worked within the tax, consulting and auditing branches of the company from 2005.
According to Fusion.net, it appears the data was among other documents of one Sony employee that worked in human resources, and previously worked at Deloitte - apparently, they had saved some interesting HR files from their tenure.
Deloitte, one of the largest consulting firms in the world providing audit, tax, risk and financial advisory services, has, needless to say, a ton of financial data on thousands of enterprise companies. Although they weren’t hacked per se, any internal information about the company being leaked is bad news.
Payroll Companies Breached
Another report of an intrusion comes from the specialized payroll company, American Residuals and Talent (ART Payroll) that services the advertising, entertainment and events production industry, including members of the Screen Actors Guild-American Federation of Television and Radio Artists, according to the LATimes.com.
ART Payroll recently reported an intrusion after detecting an unauthorized login to their web application. Data accessed includes client names, Social Security numbers, addresses, bank account information, date of birth and email addresses.
Payroll & HR Data Stolen for Tax Fraud
KrebsonSecurity.com reported on a similar incident in which a third-party payroll and HR management provider and software, Ultimate Software (UltiPro Services) was exploited with the use of stolen credentials. Attackers stole the W2’s of employees of health systems and other healthcare organizations in order to submit fraudulent tax refunds.
And yet another breach of a senior living provider was linked to the same intruders that exploited the same software by using stolen payroll vendor credentials; stealing over 43k employee records and using them for tax fraud. Read more in Lax Healthcare Vendor Security Leads to Data Breaches & Tax Fraud.
The point is, any attack against financial information may involve the same attack vectors - including stealing credentials and accessing HR and payroll information via web applications. For any organization with sensitive information accessible via web apps, two-factor authentication can stop attempted remote attacks.
Integrating two factor with cloud-based or on-premises web apps is simple - watch our integration video to see how to set up Duo Security’s two-factor authentication using our Web SDK in seven minutes. Read more about Duo Web.